CVE-2025-49889: Edge CPT PHP File Inclusion Vulnerability

CVE-2025-49889 Overview

CVE-2025-49889 is a PHP Local File Inclusion (LFI) vulnerability in the Edge-Themes Edge CPT WordPress plugin. The flaw stems from improper control of a filename used in a PHP include or require statement, classified under [CWE-98]. Attackers can abuse the flaw to load arbitrary local PHP files into the plugin's execution context. All versions of Edge CPT up to and including 1.4 are affected. Successful exploitation can disclose sensitive files, expose credentials, and lead to code execution when combined with file upload primitives or log poisoning.

Critical Impact
Unauthenticated network attackers can include arbitrary local files, exposing WordPress secrets and enabling downstream code execution.

Affected Products

Edge-Themes Edge CPT plugin for WordPress, versions up to and including 1.4
WordPress installations with the Edge CPT plugin activated
Sites using Edge-Themes products that bundle the Edge CPT dependency

Discovery Timeline

2025-08-20 - CVE-2025-49889 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49889

Vulnerability Analysis

The Edge CPT plugin passes attacker-controlled input into a PHP file inclusion statement without sufficient validation. When a request supplies a crafted filename parameter, the plugin resolves the path and executes the target file through include or require. This behavior falls under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program.

Because the vulnerable code path is reachable over the network without authentication, an attacker only needs to send an HTTP request to a WordPress site running Edge CPT ≤ 1.4. Exploitation reads arbitrary local files, including wp-config.php, and can escalate to remote code execution if the attacker can plant PHP content in a predictable location such as an uploads directory or a poisoned log file.

Root Cause

The plugin constructs a file path from request-supplied data and uses it directly in a PHP inclusion statement. The code does not enforce a strict allowlist of permitted files, does not canonicalize the path, and does not restrict traversal sequences such as ../. Any user-controlled string reaching the include call is treated as a valid module path.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the vulnerable endpoint exposed by the plugin. The request supplies a path parameter that resolves to a target file on the WordPress server, such as wp-config.php or PHP session data. When PHP includes the file, its contents are parsed and executed within the application context. Chaining LFI with log poisoning, session injection, or file upload primitives yields arbitrary PHP code execution under the web server user.

See the Patchstack WordPress Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-49889

Indicators of Compromise

HTTP requests to Edge CPT plugin endpoints containing path traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f
Access log entries referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files in query parameters
Unexpected PHP execution originating from wp-content/plugins/edge-cpt/ referencing files outside the plugin directory
New or modified PHP files in the wp-content/uploads/ directory following suspicious inclusion requests

Detection Strategies

Inspect web server access logs for requests targeting Edge CPT parameters with file paths or traversal patterns
Deploy WordPress-aware web application firewall rules that flag inclusion of local file names in plugin query strings
Correlate PHP error logs referencing failed include/require calls originating from the Edge CPT plugin
Baseline plugin request patterns and alert on anomalous parameter values that reference filesystem paths

Monitoring Recommendations

Monitor egress traffic from web servers for exfiltration of configuration files after suspicious plugin requests
Track WordPress plugin inventory to detect installations of Edge CPT ≤ 1.4 across your estate
Enable file integrity monitoring on wp-config.php, plugin directories, and the uploads folder
Forward web server, PHP-FPM, and WAF logs to a central data lake for cross-source correlation

How to Mitigate CVE-2025-49889

Immediate Actions Required

Deactivate and remove the Edge CPT plugin if a patched version is not yet available for your installation
Restrict access to WordPress admin and plugin endpoints via IP allowlisting or authentication proxies where feasible
Rotate any secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
Deploy virtual patching through a web application firewall to block traversal patterns in Edge CPT parameters

Patch Information

At the time of publication, the vendor advisory listed on Patchstack indicates the vulnerability affects Edge CPT versions through 1.4 with no fixed version identified. Administrators should consult the Patchstack WordPress Vulnerability Report for the current patch status and monitor the Edge-Themes support channels for a security release.

Workarounds

Remove the Edge CPT plugin directory from the WordPress installation until a fix is confirmed
Configure the web server to deny direct HTTP requests to plugin PHP files that accept path parameters
Set open_basedir in php.ini to restrict PHP file operations to the WordPress document root
Disable allow_url_include and confirm allow_url_fopen is set to Off to reduce inclusion risk

bash

# Configuration example: harden PHP against file inclusion abuse
# /etc/php/8.2/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Nginx: block traversal patterns targeting the Edge CPT plugin
location ~* /wp-content/plugins/edge-cpt/ {
    if ($args ~* "(\.\./|%2e%2e|wp-config)") {
        return 403;
    }
}